Frameworks
MITRE ATLAS: the attack matrix for AI systems, with technique IDs
MITRE ATLAS explained: how it differs from ATT&CK and the OWASP LLM Top 10, with a table of LLM, RAG and agent technique IDs checked in release v2026.10.
Short answer
MITRE ATLAS is a knowledge base of adversary tactics, techniques and case studies for AI systems, modeled on ATT&CK. Release v2026.10 lists 16 tactics, 129 techniques and 77 case studies. Testers use technique IDs such as AML.T0051 (LLM Prompt Injection) to name attacks in a shared language and to map findings to a catalog.
MITRE ATLAS is a public knowledge base of adversary tactics, techniques and real case studies for AI systems. It follows the structure of MITRE ATT&CK. Red teams use its technique IDs to name attacks the same way across reports.
What is MITRE ATLAS?#
ATLAS is a matrix of tactics (the attacker's goal at a stage) and techniques (how the attacker does it). Each technique has an ID that starts with AML.T. Sub-techniques add a suffix, such as AML.T0051.001. Case studies have IDs that start with AML.CS.
We checked the data file of release v2026.10, tagged 28 October 2026. We counted IDs in that file: 16 tactics, 129 techniques, 92 sub-techniques, 44 mitigations and 77 case studies. The count rule is IDs that match AML.T#### for techniques and AML.T####.### for sub-techniques. The atlas.mitre.org site needs JavaScript, so we did not read its own counts, which may differ from ours.
The 16 tactics are: AI Model Access, AI Attack Adaptation, Reconnaissance, Resource Development, Initial Access, Execution, Persistence, Defense Evasion, Discovery, Collection, Exfiltration, Impact, Privilege Escalation, Credential Access, Command and Control and Lateral Movement. Most tactic names will be familiar to ATT&CK users.
Which ATLAS techniques apply to LLM apps, RAG and agents?#
The table lists the techniques we use most when testing LLM applications. Each row gives the ID, the name, the tactic the v2026.10 data file links to it, and the question a tester asks.
| ID | Name | Tactic in v2026.10 | What a tester checks |
|---|---|---|---|
| AML.T0051 | LLM Prompt Injection | Execution | Can text in a prompt change what the model does? |
| AML.T0051.000 | Direct (sub-technique of LLM Prompt Injection) | Execution | Can a user of the app inject instructions in their own input? |
| AML.T0051.001 | Indirect (sub-technique of LLM Prompt Injection) | Execution | Can content the app reads (page, file, email, ticket) carry instructions? |
| AML.T0054 | LLM Jailbreak | Defense Evasion, Privilege Escalation | Can a user make the model ignore its safety rules or guardrails? |
| AML.T0053 | AI Agent Tool Invocation | Execution, Privilege Escalation, Lateral Movement | Can untrusted text make an agent call a tool it should not call? |
| AML.T0070 | RAG Poisoning | Persistence | Can an attacker place content in the knowledge base that the model later trusts? |
| AML.T0071 | False RAG Entry Injection | Defense Evasion | Can an attacker insert a fake entry that looks like a trusted source? |
| AML.T0080 | AI Agent Context Poisoning | Persistence | Can an attacker change an agent's memory or context so the change lasts? |
| AML.T0110 | AI Agent Tool Poisoning | Persistence | Can a tool's description or definition carry hidden instructions? |
| AML.T0086 | Exfiltration via AI Agent Tool Invocation | Exfiltration | Can an agent send data out through a tool call, such as a web request or an email? |
| AML.T0136 | Exfiltration via AI User Interface | Exfiltration | Can output rendering leak data, for example a markdown image URL? |
| AML.T0024 | Exfiltration via AI Inference API | Exfiltration | Can calls to the model API reveal data it should not return? |
In the data file, the sub-techniques AML.T0051.000 and AML.T0051.001 link to the Execution tactic, like their parent. A third sub-technique, AML.T0051.002 (Triggered), also exists.
Important
Older articles cite AML.T0057 "LLM Data Leakage". That ID is not in the v2026.10 file. Use AML.T0086, AML.T0136 or AML.T0024 for the leakage path you tested, or the Exfiltration tactic AML.TA0010 when you only know the stage.
What case studies does ATLAS include?#
ATLAS case studies document real incidents and research. Five match the failure modes we test most often, with IDs from the same v2026.10 file.
- AML.CS0020: Indirect Prompt Injection Threats: Bing Chat Data Pirate.
- AML.CS0021: ChatGPT Conversation Exfiltration.
- AML.CS0035: Data Exfiltration from Slack AI via Indirect Prompt Injection. Our guide on indirect prompt injection covers it.
- AML.CS0045: Data Exfiltration via an MCP Server used by Cursor. See MCP security risks.
- AML.CS0059: EchoLeak: Zero-Click Prompt Injection Targeting M365 Copilot for Data Exfiltration.
Case studies help with threat modeling because they show which preconditions the attacker needed. A buyer can ask whether the same chain applies to their product.
How do ATLAS, OWASP and NIST fit together?#
Each framework has a different job, and a customer may ask for all three.
| Framework | Job | Typical use in a report |
|---|---|---|
| OWASP Top 10 for LLM Applications | Rank the main risks and give fixes | Set priorities; group findings by risk category |
| MITRE ATLAS | Catalog adversary techniques and case studies | Name the attack path; link to a known technique ID |
| NIST AI RMF and AI 600-1 | Set the risk management process | Show where testing fits in govern, map, measure, manage |
The OWASP guide and the NIST guide cover the other two. The frameworks page shows how we map findings. A mapping is a label for a finding, not a certification or a test result.
How should you use ATLAS IDs in a report?#
Put the ID in the finding, next to the evidence, and keep the finding text in plain words. Follow these rules:
- State the ATLAS release. For example: "ATLAS v2026.10". IDs change between releases.
- Map after you test. Do not pick a technique first and then look for a match. Record the observed behavior, then choose the closest ID.
- Accept that some findings have no match. A refund promise that your policy does not allow, for example, has no ATLAS technique. Report it anyway.
Format example
This is a demonstration of a finding line. It is not a real result, and no real customer system was tested.
"Indirect injection through a support ticket made the agent call the email tool (ATLAS v2026.10: AML.T0051.001, AML.T0053; observed 4 of 10 attempts)."
To plan a test around these techniques, use the scoping guide, then send a scoping request.
Questions
Is MITRE ATLAS the same as MITRE ATT&CK?
No. ATLAS follows the same structure as ATT&CK, with tactics, techniques and case studies, but it covers attacks on AI systems. It reuses some ATT&CK ideas, for example the Exfiltration tactic. Use ATT&CK for classic IT intrusions and ATLAS for the AI parts of an attack.
Does ATLAS replace the OWASP Top 10 for LLM Applications?
No. They answer different questions. OWASP ranks the main risks in LLM applications and gives fixes. ATLAS catalogs what an adversary does, step by step, with real case studies. Teams often use OWASP to set priorities and ATLAS to describe the attack path.
Why did the data leakage technique ID disappear?
In release v2026.10 the file has no AML.T0057 (LLM Data Leakage). We could not confirm from the file why. Do not cite that ID. For leakage through agents, UI rendering or inference APIs, use the techniques named in the technique table.
How often does ATLAS change?
Often. MITRE ships dated releases in a YYYY.MM form. The release we checked is v2026.10, tagged 28 October 2026. An older 5.6.0 file says it is deprecated. Always state the release when you cite an ID.
Sources
- MITRE ATLAS (checked 9 November 2026)
- mitre-atlas/atlas-data release v2026.10 (tagged 2026-10-28) (checked 9 November 2026)
- ATLAS-2026.10.yaml (data file used to check IDs, names and tactics) (checked 9 November 2026)
- mitre-atlas/atlas-data repository (checked 9 November 2026)